Externalization in LLM Agents: A Unified Review of Memory, Skills, Protocols and Harness Engineering — part 11/11

Cleaned-text code points [155402, 164437). Bibliography omitted here; source.md includes it.

Cognitive overhead is a performance cost; the security dimension is more consequential. Once cognitive and procedural burdens are relocated into external artifacts, those artifacts become targets—and the threats map directly onto the three harness dimensions. Memory poisoning can silently distort future reasoning through corrupted episodic traces or factual stores. Malicious skill injection can embed adversarial procedures into the agent’s reusable repertoire. Protocol spoofing—forged tool manifests or manipulated endpoints—can cause unauthorized actions under the appearance of legitimate interaction ( Liu et al., 2026 ; Guo et al., 2026 ; Wang et al., 2026c ; Lin et al., 2025b ) . These risks are compounded when externalization becomes self-evolving (Section 8.3 ): adapting to new tasks can degrade old ones, accumulated patches can obscure system behavior, and optimization targets can be distorted when human supervision weakens.

##### Governance as infrastructure.

The implication is that externalization must be paired with governance—not as an afterthought, but as a co-designed layer of the harness. Mandatory review gates for critical updates, provenance tracking for memory and skill changes, deterministic rollback mechanisms, and regression testing all become part of the infrastructure. The quality of an externalized system is therefore measured not only by what it enables, but by how transparently and reversibly it does so. This criterion also informs evaluation, as discussed in Section 8.6 .

### 8.5 From Private Scaffolding to Shared Infrastructure

The externalization described so far is largely agent-centric: memory serves one agent’s continuity, skills are loaded as local packages, and protocols often remain framework-bound. As collaboration chains lengthen, however, externalization begins to shift from private scaffolding toward shared infrastructure ( Wang and Chen, 2025 ; Li et al., 2026a ; Nie et al., 2026 ) . This changes the unit of analysis from the individual agent to the ecosystem.

##### Shared artifacts.

The clearest sign is the emergence of shareable artifacts across all three dimensions. Shared memory shifts the question from “what I remember” to “what we know,” turning memory into a transactive system of shared state, indices, and common ground ( Wegner, 1987 ; Zhao et al., 2026b ) . Shared skills turn procedural expertise into public capability units that can be reused, forked, and maintained across agents ( Ling et al., 2026 ) . Shared protocols provide the common grammar that makes such coordination interoperable across platforms and organizations ( Yang et al., 2025b ) .

##### Division of labor and collective learning.

Once these structures are shared, agent systems can differentiate roles rather than replicate the same full stack everywhere. Drawing on stigmergy ( Theraulaz and Bonabeau, 1999 ) , failure trajectories can accumulate in shared memory while successful paths crystallize into shared skills. Learning then diffuses through external structures rather than only through joint parametric training.

##### Institutionalization and its tensions.

As memory schemas, skill specifications, and protocol bindings are repeatedly validated, they begin to function less like temporary scaffolding and more like institutions: shared operating procedures and standards that coordinate behavior at ecosystem scale ( Hutchins, 1995 ) . But shared infrastructure also introduces new governance problems ( Deng et al., 2025 ; Liu et al., 2026 ; Kong et al., 2025 ) . Infrastructure drift, malicious or low-quality artifacts, and premature or delayed standardization can all destabilize the ecosystem ( Guo et al., 2026 ; Timmermans and Epstein, 2010 ) . The governance costs identified in Section 8.4 are therefore amplified when externalization becomes collective: version control, permission auditing, provenance, and rollback become part of the institutional design of agent systems, not just the engineering of individual harnesses.

### 8.6 Measuring Externalization

Most current benchmarks evaluate agents primarily through task completion under fixed prompts and fixed model settings ( Zhu et al., 2025 ; Mishra et al., 2026 ) . That is useful for comparing base-model capability, but it systematically under-measures the contribution of externalized infrastructure. A harness that improves reliability through better memory retrieval, more precise skill loading, or tighter execution governance will show up only as a higher pass rate, with no way to attribute the gain to its actual source.

A richer evaluation agenda would assess the quality of externalization along dimensions that current benchmarks largely ignore. Transferability asks whether the same harness configuration maintains its effectiveness when the underlying model is swapped—a direct test of how much capability resides in external infrastructure versus weights. Maintainability measures how gracefully the system degrades when skills, memory policies, or protocol schemas are updated. Recovery robustness tests whether the agent can detect failures, roll back partial actions, and resume from checkpoints. Context efficiency quantifies how much of the context budget is consumed by harness overhead versus task-relevant reasoning. Governance quality evaluates whether the externalized system meets the transparency and reversibility requirements identified in Section 8.4 .

Concrete evaluation strategies might include ablation studies that remove individual harness components and measure the resulting degradation; cross-model transfer tests that hold the harness constant while varying the base model; and long-horizon reliability metrics that track success rates, cost, and drift over extended multi-session interactions rather than single-turn completions. Until such methods mature, the field will continue to attribute to model intelligence what is partly an achievement of externalization design. For instance, the Agent Humanization Benchmark (AHB) suggests that agent evaluation should extend beyond task completion to the humanization of observable behavior at the user-interface boundary, especially for mobile GUI agents operating in human-centric environments Zhu et al. (2026) .

Taken together, these six directions trace the continuing logic of externalization beyond its current state. The frontier is expanding as new cognitive burdens—including multi-modal perception and cross-modal reasoning—become candidates for externalization; the same decomposition logic is extending from digital agents to embodied systems, where the cerebrum–cerebellum split recapitulates the separation of planning from execution; the process is becoming more autonomous through self-evolving harnesses; the trade-offs are sharpening as cognitive overhead and security risks accumulate; the scope is widening from private scaffolding to shared infrastructure; and the evaluation challenge is growing more pressing as externalization’s contribution remains invisible to model-centric benchmarks. The common thread is that externalization is not a one-time architectural decision but an ongoing design process whose boundaries, mechanisms, costs, and quality criteria co-evolve with the models and ecosystems they serve.

## 9 Conclusion

This paper has argued that externalization is the transition logic connecting many of the most important developments in LLM agents. Reliable agency increasingly depends on relocating selected cognitive burdens out of the model and into explicit infrastructure: memory externalizes state across time, skills externalize procedural expertise, protocols externalize interaction structure, and the harness coordinates these layers into a working runtime.

From this perspective, the move from weights to context to harness is not just a sequence of engineering tricks. It marks a shift in where agent capability is organized. Some burdens remain well handled parametrically, but others become more reliable once they are made persistent, inspectable, reusable, and governable outside the model.

What unifies these forms of externalization is representational transformation. Memory turns recall into retrieval, skills turn improvised generation into guided composition, and protocols turn ad hoc coordination into structured exchange. The effect is not simply to add more components around the model, but to change the task the model is being asked to solve.

This reframing also clarifies the agenda ahead. The key questions are no longer only how to build stronger models, but how to partition capability between models and infrastructure, how to evaluate the contribution of externalized systems, and how to govern the shared artifacts on which agents increasingly rely.

The broader implication is that progress in agents will come from the co-evolution of models and external infrastructure rather than from either in isolation. On that view, better agents are not merely better reasoners. They are better organized cognitive systems.